Filoven is built so that most of your data never leaves your device. This page explains exactly what is processed where.
Most website tools run entirely in your browser using JavaScript and WebAssembly. Those tools read files into memory on your machine, convert them there, and offer them back as downloads without uploading them to our servers.
Tools that require server processing, including speech transcription, are labeled with a credit cost before you run them. Files sent to those tools follow the API processing rules below.
Because the conversion is local, closing the tab discards the file from memory. We keep no copy and cannot recover a conversion for you after the fact.
Requests to our /api/v1 endpoints do send file contents to our servers, because that is the point of a server-side API. Files are processed in memory and discarded as soon as the response is returned. We do not write them to disk or to any database.
Two endpoints forward your content to a third-party AI provider in order to work: image OCR and speech transcription. Do not send those endpoints material you are not comfortable sharing with a third-party processor.
For every API call we log the timestamp, the tool used, and the credits charged, so that billing and usage limits work. We do not log request bodies or file contents.
If you create an account we store your email address, an authentication record, your plan, and your credit balance. Authentication and storage are handled by Supabase acting as our processor.
API keys are stored only as a SHA-256 hash. We cannot show you a key again after it is created - if you lose it, revoke it and generate a new one.
Payments are processed by PayPal. Card and PayPal account details are entered on PayPal's own checkout page and never reach our servers. We receive and store only the identifiers PayPal gives us: payer ID, subscription ID, plan, and status.
Messages sent through the contact form are stored in our database together with the name and email you provide, so that support administrators can review and reply to them. Contact messages are deleted after 24 months.
If Google Analytics is configured, it loads only after you choose Allow analytics. It counts page views and tool usage, uses IP anonymization, and may set browser storage or share usage data with Google. The site works normally if you decline.
Authentication uses essential browser storage to keep you signed in. There is no advertising tracking on this site.
Account records are kept while your account exists. API usage logs are kept for 24 months for billing and abuse prevention. Extraction review records are kept for 12 months. Uploaded API files are never retained. Browser conversions are never received in the first place.
You can request access to, correction of, or deletion of your personal data, and you can request that we stop processing it. Deleting your account removes your profile, API keys, and usage history.
Write to support@filoven.com or use the contact form and we will respond within 30 days.
Filoven is not directed at children under 13 and we do not knowingly collect their data.
If this policy changes materially we will update the date at the top of this page and, for account holders, notify you by email before the change takes effect.